Data Security and Privacy
Data security protects confidentiality, integrity, and availability; privacy governs lawful and responsible use of personal data. The exam tests classification, access control, protection techniques, retention, and privacy-by-design.
Core rules
- Classify data first: public, internal, confidential, restricted, plus personal and sensitive categories. Controls follow classification.
- Apply least privilege and need-to-know using roles (RBAC) and, where context matters, attributes (ABAC). Review entitlements and service accounts.
- Protect data in motion and at rest with encryption; use masking, tokenization, or pseudonymization for non-production and broad-access use.
- Apply privacy principles: purpose limitation, minimization, consent or lawful basis, retention limits, and data-subject rights.
- Assess higher-risk processing with a DPIA and log access to sensitive data.
Worked example
An analytics team requests customer records for churn analysis. The steward defines the purpose, approves a masked view with region and tenure but no name, address, or full tax ID, and grants a role scoped to that view. Export of raw data is blocked; the team works in the governed workspace. Retention is set to 90 days. The reasoning: the business need is satisfied with the minimum data and a control that survives reporting and export, not just the first query.
Traps
- Equating security with compliance evidence; controls must operate.
- Masking in a report but leaving raw exports open.
- Over-privileged service accounts and shared credentials.
- Retaining personal data indefinitely because deletion is inconvenient.